SpecterOps Blog

Research & Tradecraft

Maestro: Abusing Intune for Lateral Movement Over C2

Company Updates

Life at SpecterOps: The Red Team Dream

TL;DR We are hiring consultants at various levels. The job posting can be found under the Consultant opening here: https://specterops.io/careers/#careers…

Research & Tradecraft

Navigating the Uncharted: A Framework for Attack Path Discovery

This is the second post in a series on Identity-Driven Offensive Tradecraft, which is also the focus of the new…

BloodHound

BloodHound Operator — Dog Whispering Reloaded

BloodHound Operator — Dog Whispering Reloaded It’s summer 2024 and we are back! Actually, we are SO back, so I decided that…

BloodHound

Hybrid Attack Paths, New Views and your favorite dog learns an old trick

Introducing Hybrid Attack Paths Death from Above: An Attack Path from Azure to Active Directory With BloodHound When we introduced Azure…

Research & Tradecraft

How Privileged Identity Management Affects Conditional Access Policies

Introduction When administrators use directory roles (aka Entra ID roles) when configuring Conditional Access Policies (CAPs), users are not included…

Industry Insights

Plenty of Phish in the Sea

Phishing School How to Find the Right Phishing Targets A weapon is useless unless you have something to aim it at.…

Research & Tradecraft

Manual LDAP Querying: Part 2

This post is a follow-up to my previous post on manual LDAP querying. I would highly recommend reading that post…

Research & Tradecraft

Nemesis 1.0.0

In August of last year, @tifkin_, @0xdab0, and I released Nemesis, our offensive data enrichment platform. After lots of feedback,…